Support safari_ecdhe_ecdsa_bug for openssl_options

[users/heiko/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index b024f72270dd588bf81d8f160d4614c505cd0618..29214e3e19832434a123a4430a2159b1163f82e7 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -9777,6 +9777,16 @@ This operator converts a hex string into one that is base64 encoded. This can
 be useful for processing the output of the MD5 and SHA-1 hashing functions.
 
 
+
+.vitem &*${hexquote:*&<&'string'&>&*}*&
+.cindex "quoting" "hex-encoded unprintable characters"
+.cindex "&%hexquote%& expansion item"
+This operator converts non-printable characters in a string into a hex
+escape form. Byte values between 33 (!) and 126 (~) inclusive are left
+as is, and other byte values are converted to &`\xNN`&, for example a
+byt value 127 is converted to &`\x7f`&.
+
+
 .vitem &*${lc:*&<&'string'&>&*}*&
 .cindex "case forcing in strings"
 .cindex "string" "case forcing"
@@ -10327,6 +10337,8 @@ ${if forany{<, $recipients}{match{$item}{^user3@}}{yes}{no}}
 The value of &$item$& is saved and restored while &*forany*& or &*forall*& is
 being processed, to enable these expansion items to be nested.
 
+To scan a named list, expand it with the &*listnamed*& operator.
+
 
 .vitem &*ge&~{*&<&'string1'&>&*}{*&<&'string2'&>&*}*& &&&
        &*gei&~{*&<&'string1'&>&*}{*&<&'string2'&>&*}*&
@@ -14730,6 +14742,8 @@ Possible options may include:
 .next
 &`no_tlsv1_2`&
 .next
+&`safari_ecdhe_ecdsa_bug`&
+.next
 &`single_dh_use`&
 .next
 &`single_ecdh_use`&
@@ -14745,6 +14759,15 @@ Possible options may include:
 &`tls_rollback_bug`&
 .endlist
 
+.new
+As an aside, the &`safari_ecdhe_ecdsa_bug`& item is a misnomer and affects
+all clients connecting using the MacOS SecureTransport TLS facility prior
+to MacOS 10.8.4, including email clients.  If you see old MacOS clients failing
+to negotiate TLS then this option value might help, provided that your OpenSSL
+release is new enough to contain this work-around.  This may be a situation
+where you have to upgrade OpenSSL to get buggy clients working.
+.wen
+
 
 .option oracle_servers main "string list" unset
 .cindex "Oracle" "server list"
@@ -27074,6 +27097,21 @@ the message is ultimately accepted. For details, see section &<<SECTremoveheadac
 .cindex "&%set%& ACL modifier"
 This modifier puts a value into one of the ACL variables (see section
 &<<SECTaclvariables>>&).
+
+
+.vitem &*udpsend*&&~=&~<&'parameters'&>
+This modifier sends a UDP packet, for purposes such as statistics
+collection or behaviour monitoring. The parameters are expanded, and
+the result of the expansion must be a colon-separated list consisting
+of a destination server, port number, and the packet contents. The
+server can be specified as a host name or IPv4 or IPv6 address. The
+separator can be changed with the usual angle bracket syntax. For
+example, you might want to collect information on which hosts connect
+when:
+.code
+udpsend = <; 2001:dB8::dead:beef ; 1234 ;\
+             $tod_zulu $sender_host_address
+.endd
 .endlist
 
 
@@ -28844,6 +28882,9 @@ following SMTP commands are sent:
 LHLO is used instead of HELO if the transport's &%protocol%& option is
 set to &"lmtp"&.
 
+The callout may use EHLO, AUTH and/or STARTTLS given appropriate option
+settings.
+
 A recipient callout check is similar. By default, it also uses an empty address
 for the sender. This default is chosen because most hosts do not make use of
 the sender address when verifying a recipient. Using the same address means
@@ -35640,7 +35681,7 @@ has &%use_shell%& enabled.
 .next
 A number of options such as &%forbid_filter_run%&, &%forbid_filter_perl%&,
 &%forbid_filter_dlfunc%& and so forth which restrict facilities available to
-&_.forward_ files in a redirect router. If Exim is running on a central mail
+&_.forward_& files in a redirect router. If Exim is running on a central mail
 hub to which ordinary users do not have shell access, but home directories are
 NFS mounted (for instance) then administrators should review the list of these
 forbid options available, and should bear in mind that the options that may